Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6aed040 authored by David S. Miller's avatar David S. Miller
Browse files

Revert "net/ipv6: fix metrics leak" 



This reverts commit df18b504.

This change causes other problems and use-after-free situations as
found by syzbot.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c01f6c9b

net/ipv6/ip6_fib.c

+4 −14
Original line number Diff line number Diff line
@@ -167,22 +167,11 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags) 
	return f6i;

}



static void fib6_metrics_release(struct fib6_info *f6i)

{

	struct dst_metrics *m;



	if (!f6i)

		return;



	m = f6i->fib6_metrics;

	if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))

		kfree(m);

}



void fib6_info_destroy_rcu(struct rcu_head *head)

{

	struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);

	struct rt6_exception_bucket *bucket;

	struct dst_metrics *m;



	WARN_ON(f6i->fib6_node);
@@ -212,7 +201,9 @@ void fib6_info_destroy_rcu(struct rcu_head *head) 
	if (f6i->fib6_nh.nh_dev)

		dev_put(f6i->fib6_nh.nh_dev);



	fib6_metrics_release(f6i);

	m = f6i->fib6_metrics;

	if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))

		kfree(m);



	kfree(f6i);

}
@@ -896,7 +887,6 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i, 


			from = rcu_dereference_protected(pcpu_rt->from,

					     lockdep_is_held(&table->tb6_lock));

			fib6_metrics_release(from);

			rcu_assign_pointer(pcpu_rt->from, NULL);

			fib6_info_release(from);

		}